Search: xss.is

CVE-2026-115612 is a stored cross-site scripting (XSS) vulnerability in the SliceWP plugin by iova.mihai. It affects versions from initial releases up to 1.2.13. The flaw involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. This vulnerability has a high severity with a CVSS score of 7.1. A fix is available in version 1.2.14.

CVE-2026-115593 is a reflected cross-site scripting (XSS) vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) affecting versions before 2.0.25. This flaw allows improper neutralization of input during web page generation, potentially enabling an attacker to execute arbitrary scripts in the context of the affected web application.

CVE-2026-115596 is a high-severity reflected Cross-site Scripting (XSS) vulnerability in impleCode eCommerce Product Catalog affecting versions before 3.6.5. The flaw allows improper neutralization of input during web page generation, which can lead to execution of malicious scripts in the context of the affected web application. A fix is available in version 3.6.5.

CVE-2026-115957 is a stored cross-site scripting (XSS) vulnerability in WP Discussion Board affecting versions from initial release up to 2.6.0. The flaw allows improper neutralization of input during web page generation, potentially enabling an attacker with limited privileges to execute malicious scripts. A fix is available in version 2.6.1.

CVE-2026-115606 is a stored cross-site scripting (XSS) vulnerability in Crowd Favorite's DXP ToolKit affecting versions prior to 2.0.2. The flaw involves improper neutralization of input during web page generation, which can lead to persistent injection of malicious scripts. This vulnerability has a high severity rating with a CVSS score of 7.1. A fix is available in version 2.0.2.

CVE-2026-115609 is a stored cross-site scripting (XSS) vulnerability in Stiofan GetPaid invoicing software. It affects versions from initial releases up to 2.8.62. The vulnerability allows improper neutralization of input during web page generation, which can lead to script injection. A fix is available in version 2.8.63.

A stored cross-site scripting (XSS) vulnerability exists in the iCagenda extension for Joomla in the url-type event Custom Field. This affects versions from 3.2.1 through 4.0.16. An attacker with low privileges can inject malicious scripts that execute with high impact on confidentiality and integrity, requiring user interaction.

Acronis Cyber Protect 17 (Linux and Windows) before build 42587 contains a cross-site scripting (XSS) vulnerability due to improper input validation. This flaw allows an attacker with high privileges and user interaction to execute malicious scripts, potentially compromising confidentiality and integrity. The vulnerability has a medium severity score of 5.7 and is fixed in build 42587.

The Webheadcoder Multi-Step Forms for Contact Form 7 WordPress plugin is vulnerable to reflected cross-site scripting (XSS) via the 'l10n_print_after' parameter in all versions up to and including 4.7. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires the targeted site to have at least one Contact Form 7 form configured with a [multistep] form-tag, as version 4.7 introduced canonicalization that blocks the attack on non-multistep forms.

A stored cross-site scripting (XSS) vulnerability exists in the DefterAsist Financial Advisor Platform due to improper neutralization of input during web page generation. This vulnerability allows attackers with limited privileges to inject malicious scripts that can be executed in the context of other users. The issue affects versions of the platform up to the date 2026-10-27. The vulnerability has a medium severity rating with a CVSS score of 5.4.

The Echo Knowledge Base plugin for WordPress versions up to and including 17.214.0 is vulnerable to reflected cross-site scripting (XSS) via the 'new_kb_config' parameter. This occurs because attacker-controlled JSON data can be merged into the knowledge base configuration and injected into a <style> element without proper escaping. The vulnerability requires the attacker to trick a user with Editor-level or higher privileges into clicking a crafted link, leading to script execution in the context of the victim's browser.

The Post Snippets WordPress plugin up to version 4.2.4 is vulnerable to stored cross-site scripting (XSS) via shortcode attributes. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, allowing entity-encoded payloads to bypass WordPress's standard sanitization and be executed at render time by the plugin's shortcode filter. This requires snippet shortcodes to be enabled.

The Mang Board plugin for WordPress versions up to and including 2.4.5 is vulnerable to stored cross-site scripting (XSS) via the 'align' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when any user views the affected page. The vulnerability arises from insufficient input sanitization and output escaping, allowing the malicious payload to persist through WordPress's wp_kses_post filtering because it contains no angle brackets. This enables script execution in viewers' browsers, including administrators previewing posts.

The CMB2 plugin for WordPress up to and including version 2.13.4 is vulnerable to a stored cross-site scripting (XSS) flaw via a wysiwyg field inside a repeatable group. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access affected pages. Exploitation requires the site integrator to render the plugin's front-end form helper with the vulnerable field on a publicly accessible page.

The DesignSetGo WordPress plugin up to version 2.11.0 contains a stored cross-site scripting (XSS) vulnerability via the 'tagName' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that become active when an administrator runs the plugin's block-conversion migration during deactivation. This vulnerability requires administrative action to trigger the payload, as attackers cannot activate it independently.

The MxChat – AI Chatbot & Content Generation plugin for WordPress contains a stored DOM-based cross-site scripting (XSS) vulnerability in the 'feedback' parameter. This affects all versions up to and including 3.2.25. The flaw allows unauthenticated attackers to inject malicious scripts that execute when an administrator views the Transcripts page. The vulnerability arises from insufficient input sanitization and output escaping.

The Hustle WordPress plugin, used for email marketing and lead generation, is vulnerable to stored cross-site scripting (XSS) via the 'content[cta_label]' parameter in all versions up to and including 7.8.14.3. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with custom-level access or higher to inject malicious scripts. By default, only administrators have the required capability, but this can be delegated to lower roles such as Subscribers, potentially enabling exploitation by less privileged users.

The Waitlist WooCommerce (Back in stock notifier) plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'type' shortcode attribute. This affects all versions up to and including 2.9.1. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because shortcode attribute values are not sanitized by the wp_kses_post filter and are only processed at render time.